Vendors · Questionnaire · Z.ai
Read Z.ai’s own answers to nine buyer questions
Z.ai API Services (GLM models). Each answer quotes Z.ai’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not published in the pages kept
Searched: Privacy Policy, with the Data Processing Addendum for API Services.
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for Z.ai.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
API content not stored; other customer data kept until the terms end, with listed exceptions
This information is processed in real-time to provide the Customer and End Users with the API Service and is not saved on our servers.
In the Data Processing Addendum for API Services, section 4. Section 4(c): “For Customer Data other than those provided under Section 4(b), Company will temporarily store such data for the purposes of providing the API Services or in compliance with applicable laws.” It goes on: “The Company will delete such data after the termination of the Terms unless otherwise required by applicable laws.” Privacy Policy, with the Data Processing Addendum for API Services, kept 26 Oct 2026 · sha256 a4b5f6921825
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
API content is not stored, the addendum says
The Company do not store any of the content the Customer or its End Users provide or generate while using our Services.
Data Processing Addendum for API Services, section 4(b). Privacy Policy, with the Data Processing Addendum for API Services, kept 26 Oct 2026 · sha256 a4b5f6921825
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
Generally processed in Singapore
Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore. As a result, Customer Data is generally processed in Singapore.
Privacy Policy, with the Data Processing Addendum for API Services, kept 26 Oct 2026 · sha256 a4b5f6921825
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Group companies and service providers, typically in Singapore; no list
Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore.
Privacy Policy, with the Data Processing Addendum for API Services, kept 26 Oct 2026 · sha256 a4b5f6921825
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: Privacy Policy, with the Data Processing Addendum for API Services.
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
No answer kept
Z.ai links no status page; status.z.ai does not resolve. The page.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Not read
This site reads no retirement page for Z.ai.
- Z.ai, Privacy Policy, with the Data Processing Addendum for API Services, kept 26 Oct 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.